ClawHub
Back to skill

Security audit

个性化新闻助手免费版

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent personalized news helper, but users should understand it stores local preference/history files and personalized searches may reveal interests to search providers.

Before installing, be comfortable with the skill keeping a local ~/news profile and history, and remember that searches based on your interests may be visible to whichever search service your agent uses. Avoid putting sensitive personal, financial, medical, or workplace-confidential interests into the profile unless that is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition says the skill should be used for generating marketing copy, writing content, title optimization, and content creation, which is unrelated to a personalized news briefing tool. Overly broad and contradictory routing can cause the agent to invoke this skill in inappropriate contexts, increasing the chance of unnecessary data collection, wrong tool usage, or accidental execution of file/network behaviors outside user intent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 422)May include surrounding context.

免费版基于 Markdown 指令驱动，无需额外 API Key。所有新闻获取通过 Agent 内置搜索能力完成.

bash
# 验证本地目录可写
mkdir -p ~/news && echo "ok" > ~/news/test && rm ~/news/test && echo "目录就绪"

可用性分类

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest advertises privacy-first local storage and implies user data is not uploaded, yet the skill depends on external network/news search services to fulfill personalized requests. That creates a privacy and transparency gap because personalized queries or derived interests may be sent to external providers even if raw files remain local.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is a news/personalization workflow but explicitly requests shell execution capability, expanding its privilege surface beyond what is needed for summarization and preference storage. In an agent setting, granting exec to a content-oriented skill increases the chance of unintended filesystem changes or command execution through prompt confusion, copied examples, or future unsafe extensions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill stores interest profiles and reading history locally, but the usage flow does not prominently warn users at the point of collection that this behavioral data will be persisted. This is a privacy-consent issue: users may reveal sensitive interests or habits without understanding that the information will be retained across sessions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation states that no user data will be sent to external services, but the skill also requires external search/network access to obtain news. In practice, topic-specific searches based on a user's interests, history, or timing preferences can leak personal profile information to third-party services, making the claim misleading and unsafe from a privacy perspective.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The comparison table states '中文为主' for the free version, but the document does not present this as a user choice or clearly justify it as a region-specific tool. This creates a language policy concern because the skill appears to impose a default language preference without explicit opt-in.

Content

No source excerpt is available for this finding.